Auth.GetUserPrivateKey API CWE-59 in AWS RES <2026.06: Improper Link Res
CVE-2026-14904 Published on July 7, 2026
RES Auth.GetUserPrivateKey Arbitrary File Read
AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS.
Improper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could read arbitrary files on the cluster-manager EC2 instance by replacing their SSH private key file (~/.ssh/id_rsa) with a symbolic link targeting any file on the host. Because the cluster-manager process runs as root, any file readable by root is exposed, including other users' SSH private keys and application configuration secrets.
It's recommended to upgrade to RES version 2026.06.
Vulnerability Analysis
CVE-2026-14904 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-14904 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-14904
Want to know whenever a new CVE is published for Aws Res? stack.watch will email you.
Affected Versions
AWS res:- Before and including 2026.03 is affected.